Vulnerability · Published Sep 10, 2021 · Assigned by qnap

CVE-2021-34344Stack Buffer Overflow Vulnerability in QUSBCam2

Critical 9.8

In plain English

A critical-severity out-of-bounds write in QUSBCam2 from QNAP Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.6%top 24.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A stack buffer overflow vulnerability has been reported to affect QNAP device running QUSBCam2. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QUSBCam2: QTS 4.5.4: QUSBCam2 1.1.4 ( 2021/07/30 ) and later QTS 5.0: QUSBCam2 2.0.1 ( 2021/08/03 ) and later QTS 4.3.6: QUSBCam2 1.1.4 ( 2021/07/30 ) and later QTS 4.3.3: QUSBCam2 1.1.4 ( 2021/08/06 ) and later QuTS hero 4.5.3: QUSBCam2 1.1.4 ( 2021/07/30 ) and later

Affected products (as reported)

Vendor	Product	Versions
QNAP Systems Inc.	QUSBCam2	unspecified – before 1.1.4 ( 2021/07/30 )
QNAP Systems Inc.	QUSBCam2	unspecified – before 2.0.1 ( 2021/08/03 )
QNAP Systems Inc.	QUSBCam2	unspecified – before 1.1.4 ( 2021/07/30 )
QNAP Systems Inc.	QUSBCam2	unspecified – before 1.1.4 ( 2021/08/06 )
QNAP Systems Inc.	QUSBCam2	unspecified – before 1.1.4 ( 2021/07/30 )

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.qnap.com/en/security-advisory/qsa-21-34 x_refsource_MISC